[rsyslog-notify] Forum Thread: Re: Dequeue Perfomance - (Mode 'reply')

[noreply at adiscon.com]

User: kamermans 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25547#p25547

Message: 
----------
I found the source of the memory issue.  After I split the queues up a few
days ago, I didn't create the directories for the disk-assist queues, as I
assumed Rsyslog would do that, but I was wrong!  I watched the memory
trickle down to about 300MB, and poked around to see why Rsyslog was
refusing to use the DA queues - it was showing enqueued messages, but the
queue size was always zero and they spool files were not being created.  I
created the parent dirs for the spools files and boom, the spool files were
created.  The ping loss event is over, but tomorrow will probably confirm
that it was simply not able to create the DA spool files and was forced to
keep everything in memory, which caused the OOM.  Still, I see no logs from
rsyslog itself, even though those should be in the main queue, which is
clear, but hey, at least I (seem to) have gotten to the bottom of it.